Package: krb5
Version: 1.6.dfsg.3-1
Severity: normal
The documentation say:
| -keepold
| Keeps the previous kvno's keys around. There is no easy way to
| delete the old keys, and this flag is usually not necessary except
| perhaps for TGS keys. Don't use this flag unless you know what
| you're doing. This option is not supported for the LDAP database
But the password change with -keepold does not fail on a LDAP backed
realm:
| kadmin: cpw -randkey -keepold blank
| Key for "[EMAIL PROTECTED]" randomized.
In fact, kadmin now sees two key versions:
| kadmin: getprinc blank
| [...]
| Number of keys: 4
| Key: vno 4, AES-256 CTS mode with 96-bit SHA-1 HMAC, no salt
| Key: vno 4, Triple DES cbc mode with HMAC/sha1, no salt
| Key: vno 3, AES-256 CTS mode with 96-bit SHA-1 HMAC, no salt
| Key: vno 3, Triple DES cbc mode with HMAC/sha1, no salt
Either the documentation is wrong or it should disallow the change at
all in this case.
Bastian
--
Violence in reality is quite different from theory.
-- Spock, "The Cloud Minders", stardate 5818.4
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
